1. Who we are
ShiftMaster (“we”, “us”) is an employee scheduling and payroll-calculation service for small businesses, operated from Edmonton, Alberta, Canada, and available at https://www.shiftmaster.ca. This policy explains what personal information we collect through the website and the application, why, and what choices you have. It is written to meet Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Alberta's Personal Information Protection Act and Quebec's Act respecting the protection of personal information in the private sector (Law 25).
Our person in charge of the protection of personal information (privacy officer) can be reached at privacy@shiftmaster.ca.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account | Name, email address, password (stored only as a hash by our authentication provider), portal type (employer or employee) | You, when you register or accept an invitation |
| Company | Business name, address, contact email and phone, timezone, business hours, payroll province, budget targets | The company owner or manager |
| Employee records | Name, email, phone, role, hourly wage, weekly hour limits, availability and days off, notes | The employer who adds the employee; the employee, for availability and profile edits |
| Schedules and payroll | Shifts, swap requests, publish history, hours, overtime, vacation pay, bonuses, year-to-date totals and the deductions we calculate from them | Generated from the schedule the employer builds |
| Billing | Subscription status, Stripe customer and subscription identifiers. We never see or store card numbers; Stripe collects them on its own pages. | Stripe |
| Activity log | Who created, changed or deleted a shift, employee or setting, and when | Generated as you use the app |
| Technical | IP address, browser type and request logs kept briefly by our hosting provider for security and troubleshooting | Your browser |
We do not collect social insurance numbers, dates of birth, bank details or government identifiers.
3. How we use it
- To run the service: sign you in, show the right schedule to the right person, send invitations, schedule notifications and swap-request emails.
- To calculate payroll deductions (CPP or QPP, EI, QPIP, federal and provincial income tax) from the hours and wages entered.
- To draft schedules with the AI auto-scheduler, which learns from your company's own past shifts only.
- To bill your subscription through Stripe and to keep the activity log that lets owners see who changed what.
- To answer support requests and to keep the service secure.
We do not sell personal information, we do not use it for advertising, and we do not use your data to train models for other customers.
4. Your employees' information
When an employer enters staff details, the employer is responsible for that information and for telling staff that it is being used in ShiftMaster; we process it on the employer's behalf to provide the service. Employees can see their own shifts, hours and profile in the employee portal and can update their availability and contact details there. An employee who wants their record corrected or removed should ask their employer first; they may also contact us and we will assist.
5. Service providers and where data is stored
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database and authentication | Canada (AWS ca-central-1, Montréal) |
| Vercel | Website hosting and content delivery; short-lived request logs | Global edge network; logs in the United States |
| Stripe | Subscription payments and the billing portal | United States and Canada |
| Resend | Transactional email (invitations, schedule and swap notifications, password resets) | United States |
| Google Cloud Run | AI auto-scheduler. When you run it, your company's employee identifiers, names, roles, wages and shift times are sent for processing; nothing is written to disk and the data is not retained after the request. | United States (us-west1) |
Personal information is therefore stored in Canada and may be processed outside Canada, including in the United States, by the providers above under contracts that limit their use of it to providing their service to us. Authorities in those countries may have access to it under local law.
6. Cookies and local storage
We do not set tracking or advertising cookies and we run no third-party analytics. Your browser's local storage keeps your sign-in session and a few preferences (for example whether you have finished the tutorial) so the app works; clearing it signs you out. Stripe sets its own cookies on its checkout and billing pages for fraud prevention, governed by Stripe's privacy policy.
7. Retention and deletion
- Company, employee, schedule and payroll data is kept while the company account exists.
- An owner can delete the whole company from the account menu (Danger Zone); this removes the company, its employees, shifts, payroll records and activity log from the live database immediately. Backup copies expire within 30 days.
- Employee records deleted by an employer are removed from the live database immediately.
- Stripe keeps billing records for as long as tax and accounting law requires.
- Email delivery logs at Resend and request logs at Vercel are retained for a short period by those providers.
8. Your rights
You can ask us to confirm what personal information we hold about you, to see it, to correct it, to delete it, or to stop using it, and you can withdraw consent (which may mean we can no longer provide the service). Write to privacy@shiftmaster.ca; we answer within 30 days. You can also complain to the Office of the Privacy Commissioner of Canada, and in Quebec to the Commission d'accès à l'information.
We do not make decisions about you by automated means that have legal or similarly significant effects. The AI auto-scheduler only proposes a draft; a manager reviews and publishes every schedule.
9. Security
Data is encrypted in transit (TLS) and at rest. Each company's data is isolated by database-level access rules so that one company can never read another's. Passwords are hashed by our authentication provider and never stored in clear text. Payment card details never reach our servers. If a breach creates a real risk of serious harm, we will notify affected people and the relevant privacy authorities as the law requires.
10. Changes and contact
We will post any change to this policy here with a new date, and tell account owners by email if the change is material. Questions or requests: privacy@shiftmaster.ca.